Malicious DNS Hunting - Actively Hunt For Malicious DNS Queries Made in Real Time!

Подписаться 19 тыс.

Просмотров 9 тыс.

50% 1

Join me as we hunt for malicious DNS queries made by our Windows End Points. Quickly detect when your Windows machine has asked to resolve a malicious domain name! Let's deploy a Host Intrusion Detection System and SIEM with free open source tools. Join me as we explore and learn together.
GitHub Repo: github.com/jua...
Sysmon Install: • Window's Logs on Stero...
Your Own Server: bit.ly/3Eug9Wf
Discord Channel: / discord
Check us out: www.opensecure...
Interact with our demo: www.opensecure...
Hire us: www.opensecure...

Наука

Опубликовано:

29 сен 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 14

@cesarfidel8494 Год назад

Hello Taylor, great video, thanks for the contribution, on the subject for a business network, do you have any limit to the domains to be analyzed?

@rodrigolfrs 2 года назад

Hi, thanks for your vídeo, as always very good. If my DNS windows request a malicious domain, it's possible create a active response to the wazoo client drop the IP or the domain in the firewall or something like that? When another PC request a DNS for my DNS server and he can't resolve (because they are droped), would avoid a lot of problems. Sorry about my text, English is not native language.

@taylorwalton_socfortress 2 года назад

In theory I think we could call another active response script that adds the malicious domain to the local hosts file on the windows box with the domain name pointing to the loop back addresss. Interesting concept that I will explore and hopefully be able to bring to a video! Thanks for watching!

@bitc0intech760 Год назад

Or you can use n8n to look at this process and start a script, in n8n you can do a webhook from Elasticsearch

@hamidasgari337 2 года назад

Hi, thanks for your vídeo, It Will be implemented on version 3.13?

@taylorwalton_socfortress 2 года назад

Hey Hamid, apologies but I am a little lost on what you mean by 3.13. Could you please explain more and I would love to help out? Thanks for watching!

@hamidasgari337 2 года назад

@@taylorwalton_socfortress I mean wazuh server version 3.13

@taylorwalton_socfortress 2 года назад

@@hamidasgari337 Unfortunately you need version 4.2.0 and above to take advantage of the new active response capability that we use in the PowerShell script. If you need assistance with upgrading, check out one of our previous videos: ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-bgfD_w7PN-E.html&t Thanks for watching :)

@bitc0intech760 Год назад

One question what happens when it does see a repeated domain what is the message then?